tofsee | 0b971b889d6ff55f096419e35a24a5560f5085f2cba575d60e4629a51b8fa776

Analysis

max time kernel
158s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e06ae8f7d80ef958686b2378d3936803.exe
Size 11.8MB
Sample240327-bk4sbabf81
SHA256 0b971b889d6ff55f096419e35a24a5560f5085f2cba575d60e4629a51b8fa776
MD5 e06ae8f7d80ef958686b2378d3936803
SHA1 e09cc994f9c6a81600bcf4465d21ca2922c5d368
SHA512 482b3c4a83e57949a9f583f8b99f56c6046938487dc25507fe53feae6ab490872684ae838116966b76483166d161b74cc5357c8604b3a8e41f5c93db1ae3fd62
SSDEEP 49152:ogntttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt9:o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.7
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4680	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\sqhdylwo\ImagePath = "C:\\Windows\\SysWOW64\\sqhdylwo\\mohszhvl.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	e06ae8f7d80ef958686b2378d3936803.exe

Deletes itself 1 IoCs

pid	Process
4468	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4424	mohszhvl.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4424 set thread context of 4468	4424	mohszhvl.exe	112

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2436	sc.exe
3524	sc.exe
4616	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4192	4104	e06ae8f7d80ef958686b2378d3936803.exe	98
PID 4104 wrote to memory of 4192	4104	e06ae8f7d80ef958686b2378d3936803.exe	98
PID 4104 wrote to memory of 4192	4104	e06ae8f7d80ef958686b2378d3936803.exe	98
PID 4104 wrote to memory of 4800	4104	e06ae8f7d80ef958686b2378d3936803.exe	100
PID 4104 wrote to memory of 4800	4104	e06ae8f7d80ef958686b2378d3936803.exe	100
PID 4104 wrote to memory of 4800	4104	e06ae8f7d80ef958686b2378d3936803.exe	100
PID 4104 wrote to memory of 2436	4104	e06ae8f7d80ef958686b2378d3936803.exe	103
PID 4104 wrote to memory of 2436	4104	e06ae8f7d80ef958686b2378d3936803.exe	103
PID 4104 wrote to memory of 2436	4104	e06ae8f7d80ef958686b2378d3936803.exe	103
PID 4104 wrote to memory of 3524	4104	e06ae8f7d80ef958686b2378d3936803.exe	105
PID 4104 wrote to memory of 3524	4104	e06ae8f7d80ef958686b2378d3936803.exe	105
PID 4104 wrote to memory of 3524	4104	e06ae8f7d80ef958686b2378d3936803.exe	105
PID 4104 wrote to memory of 4616	4104	e06ae8f7d80ef958686b2378d3936803.exe	107
PID 4104 wrote to memory of 4616	4104	e06ae8f7d80ef958686b2378d3936803.exe	107
PID 4104 wrote to memory of 4616	4104	e06ae8f7d80ef958686b2378d3936803.exe	107
PID 4104 wrote to memory of 4680	4104	e06ae8f7d80ef958686b2378d3936803.exe	110
PID 4104 wrote to memory of 4680	4104	e06ae8f7d80ef958686b2378d3936803.exe	110
PID 4104 wrote to memory of 4680	4104	e06ae8f7d80ef958686b2378d3936803.exe	110
PID 4424 wrote to memory of 4468	4424	mohszhvl.exe	112
PID 4424 wrote to memory of 4468	4424	mohszhvl.exe	112
PID 4424 wrote to memory of 4468	4424	mohszhvl.exe	112
PID 4424 wrote to memory of 4468	4424	mohszhvl.exe	112
PID 4424 wrote to memory of 4468	4424	mohszhvl.exe	112

C:\Users\Admin\AppData\Local\Temp\e06ae8f7d80ef958686b2378d3936803.exe
"C:\Users\Admin\AppData\Local\Temp\e06ae8f7d80ef958686b2378d3936803.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sqhdylwo\
  2⤵
  PID:4192
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mohszhvl.exe" C:\Windows\SysWOW64\sqhdylwo\
  2⤵
  PID:4800
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create sqhdylwo binPath= "C:\Windows\SysWOW64\sqhdylwo\mohszhvl.exe /d\"C:\Users\Admin\AppData\Local\Temp\e06ae8f7d80ef958686b2378d3936803.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2436
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description sqhdylwo "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3524
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start sqhdylwo
  2⤵
  - Launches sc.exe
  PID:4616
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4680

C:\Windows\SysWOW64\sqhdylwo\mohszhvl.exe
C:\Windows\SysWOW64\sqhdylwo\mohszhvl.exe /d"C:\Users\Admin\AppData\Local\Temp\e06ae8f7d80ef958686b2378d3936803.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:8
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mohszhvl.exe

Path C:\Users\Admin\AppData\Local\Temp\mohszhvl.exe
Size 1.7MB
SHA256 2bd49257d2074707a23f7cafba3ffd394cf5341882d4e742d724e0a0f8d4df18
MD5 216ef9ed4e53422d24aa63c19331024b
SHA1 a536852b483c05f2ba84173f6585b31963608018
SHA512 4f95572ef82b67e0d3f031b1037f17acf95b8e029dde517963a65d2befeae27c2368fce7ab25de8c192d1031ee4e29c9d288c8fcf89b03a1120c1dc88932203b
SSDEEP 49152:Qgntttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt+:QP
MD5 SHA1 SHA512 SSDEEP

Submit Download

mohszhvl.exe

Path C:\Windows\SysWOW64\sqhdylwo\mohszhvl.exe
Size 3.2MB
SHA256 b923a04e8bf07d566aa9434d618b4759186de36f94a6039a0cfdb2468d41f6d5
MD5 91a28f1f7137662c9f54779499e9cc2a
SHA1 8391b489806ec7e92b7c6210bcd2db85e952e570
SHA512 36b4a8d583420a8914f251579dce02c49e57f45cae425594c190a5266cd6713b6c8ac3f0c34025d33403c2af3b69631009ab46d571a03ad0afb5b5730474cbbd
SSDEEP 49152:Qgnttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt:Qw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4104-8-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4104-3-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4104-2-0x0000000000700000-0x0000000000713000-memory.dmp

Download

memory/4104-7-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4104-1-0x0000000000750000-0x0000000000850000-memory.dmp

Download

memory/4104-9-0x0000000000700000-0x0000000000713000-memory.dmp

Download

memory/4424-11-0x00000000005A0000-0x00000000006A0000-memory.dmp

Download

memory/4424-12-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4424-15-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4468-13-0x0000000001060000-0x0000000001075000-memory.dmp

Download

memory/4468-18-0x0000000001060000-0x0000000001075000-memory.dmp

Download

memory/4468-19-0x0000000001060000-0x0000000001075000-memory.dmp

Download

memory/4468-20-0x0000000001060000-0x0000000001075000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads